registry / @konnectio/core / 4.8.5
@konnectio/core@4.8.5
Konnectio Core Frontend Integration.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential transport is the browser integration’s normal bearer-token API client, and the reviewed gift-card request matches the package’s stated purpose. The Wix bundle’s token is supplied through the integration component rather than discovered from unrelated credentials.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consuming page supplies an access token and the user initiates a booking or gift-card operation.
Impact
No unrelated credential transfer, install-time behavior, or unrequested account action was identified.
Mechanism
The browser integration attaches its application token to requests for Konnectio’s hotel-service API, with an explicit page-level API URL override available.
AI rationale
The flagged credential transport is the browser integration’s normal bearer-token API client, and the reviewed gift-card request matches the package’s stated purpose. The Wix bundle’s token is supplied through the integration component rather than discovered from unrelated credentials.
Network endpoints1
production.hotel-service.konnectio.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes feature-specific browser integration entry points, including gift-card and Wix modules.
- The Wix API client uses the package’s bearer-token state and defaults to Konnectio’s hotel-service API; it allows an explicit page-level API URL override.
- The Wix component takes an accessToken prop and passes it to the package’s setAccessToken function.
- The gift-card flow posts to /gift-card/create and uses the response to proceed to payment.
Evidence against
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
6 flaggeddist/dist-CrMfGnKf.jsView file
6918else try {
L6919: result = eval(`(${expr})`);
L6920: } catch {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dist-CrMfGnKf.jsView on unpkg · L6918dist-wix/gift-card.jsView file
12contains invisible/control Unicode U+200D (zero width joiner)
`,Cx=`️`,wx=`<U+200D>`,Tx=``,Ex=null,Dx=null;function Ox(e=[]){let t={};db.groups=t;let n=new db;Ex??=Mx(Xy),Dx??=Mx(Zy),G(n,`'`,Ub),G(n,`{`,Eb),G(n,`}`,Db),G(n,`[`,Ob),G(n,`]`,kb),G(n,`(`,Ab),G(n,`)`,jb),G(n,`<`,Mb),G(n,`>`,Nb),G(n,`（`,Pb
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist-wix/gift-card.jsView on unpkg · L12•Trigger-reachable chain: manifest.exports -> dist-wix/gift-card.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist-wix/gift-card.js
CriticalTrigger Reachable Dangerous Capabilitydist-wix/gift-card.js
HighShips High Entropy Blobdist/CheckoutWindow-uSUIYV_l.js.br
HighSemantic Analysis Limiteddist-wix/hotel.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/rolldown-runtime-B0aSnxlc.js.br
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-CrMfGnKf.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @konnectio/core@4.8.5.
See all versions of @konnectio/core for other recorded verdicts.
- Review the evidence and your use of @konnectio/core@4.8.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.